EUVD-2026-50575
GHSA-h26p-54rh-wmmw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessHost crafted HTML page on attacker domain
-
DeliveryLure iOS Chrome user to the page
-
ExploitSocial-engineer specific UI gesture sequence
-
ExecutionTrigger origin validation bypass in Chrome iOS
-
ImpactExfiltrate cross-origin data to attacker
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Origin validation
|
| Exploitation Conditions | Exploitation requires the victim to be running Google Chrome on iOS at a version strictly below 151.0.7922.72 - this flaw is specific to Chrome's iOS implementation and does not affect other platforms. The attacker must deliver a crafted HTML page and then successfully social-engineer the victim into performing specific, non-trivial UI gestures while on that page; the exact gesture sequence is not publicly disclosed. Because UI:R is confirmed in the CVSS vector and SSVC rates the attack as not automatable, passive or silent exploitation is not possible - every exploit attempt requires deliberate victim interaction. Exploitation is further limited to scenarios where the target has cross-origin data accessible in the browser (e.g., an active authenticated session to a sensitive site) that can be read via the bypass. No special server-side configuration or victim-side software beyond the vulnerable Chrome iOS version is required. |
| Impact | The CVSS 3.1 base score of 3.1 with vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N accurately reflects a constrained real-world risk. The high attack complexity (AC:H) captures the practical barrier of orchestrating specific UI gesture sequences via social engineering, and mandatory user interaction (UI:R) means this cannot be silently drive-by exploited. Impact is strictly limited to low confidentiality disclosure (C:L) with no integrity or availability consequence. EPSS at 0.21% (11th percentile) independently confirms very low exploitation probability. SSVC signals are consistent: exploitation is rated 'none', the attack is not automatable, and technical impact is only 'partial'. All three frameworks - CVSS, EPSS, and SSVC - converge on the same conclusion: this is not a high-priority emergency despite being network-reachable. It is a real vulnerability warranting patching in the normal update cycle, not emergency response. |
| Exploit ScenarioDerived | An attacker registers a plausible domain and serves a crafted HTML page designed to visually prompt the victim - for example, framing a game mechanic or CAPTCHA interaction - that elicits the specific UI gestures required to trigger the origin validation bypass. When the iOS Chrome user on a version below 151.0.7922.72 visits the page and performs the prompted gestures, the page silently reads data from a cross-origin context (such as a logged-in session page) and exfiltrates it to the attacker's server. No public proof-of-concept exploit has been identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Cross-origin data leakage in Google Chrome for iOS (versions prior to 151.0.7922.72) allows remote attackers to read cross-origin data by delivering a crafted HTML page that socially engineers the victim into performing specific UI gestures. The root cause is an inappropriate implementation classified under CWE-346 (Origin Validation Error), meaning Chrome's iOS-specific code fails to correctly enforce same-origin policy boundaries under particular interaction sequences. No active exploitation has been confirmed - CISA KEV status is absent, SSVC exploitation rating is 'none', and EPSS sits at 0.21% (11th percentile) - placing this firmly in the low-priority tier despite its network delivery vector.
RemediationAI
The primary fix is upgrading Google Chrome on iOS to version 151.0.7922.72 or later, available through the Apple App Store. The patch is confirmed available per the vendor's stable channel advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html and the Chromium issue tracker at https://issues.chromium.org/issues/517690521. For organizations unable to enforce immediate updates, a compensating control is to raise user awareness around suspicious pages that prompt unusual tap or swipe sequences, as exploitation depends entirely on social engineering the victim into specific UI gestures - removing that interaction breaks the attack chain. Mobile device management (MDM) policies can also be used to enforce minimum Chrome version requirements on managed iOS devices. No meaningful network-layer mitigation exists since the attack originates from a user-visited webpage over standard HTTPS.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CWE-346 (Origin Validation Error) indicates the browser fails to properly verify origin boundaries in a specific code path within Chrome's iOS implementation. Chrome on iOS uses a distinct rendering and UI-handling layer compared to the desktop variant, as Apple's App Store policies historically required third-party browsers to use WebKit as the underlying engine - creating a unique attack surface in Chrome's own abstraction layer above WebKit. The inappropriate implementation allows a cross-origin read to be triggered when the user performs specific UI gestures on a crafted page, effectively bypassing the same-origin policy protections that should prevent one origin from reading another's data. The affected CPE string cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* covers all Chrome versions below the fix threshold on the iOS platform.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Network-delivered via webpage (AV:N), but AC:H for the required social-engineered UI gesture sequence; only low confidentiality leakage with no integrity or availability impact.
Primary rating from Vendor (Chrome).
CVSS VectorVendor: Chrome
Lifecycle Timeline
3DescriptionCVE.org
Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB